Records stay in Switzerland.
You hold the consent.
Facts before reassurance. Below: where data lives, how access is checked on every read, who else touches it, and how to delete everything.
Akten bleiben in der Schweiz. Sie behalten die Einwilligung.
Every record carries an owner. Postgres row-level security policies refuse any read that doesn’t match the requesting user or an active consent. Service role keys never reach the browser.
When you grant a vet, caregiver, sitter or walker access, the grant is logged with scope and timestamp. Edits to consent are logged too. You can review and revoke any day.
The signed-in app loads no third-party analytics, no ad pixels, no session replay. Vercel Speed Insights collects anonymous metrics only.
Request deletion from settings. Your data is purged within 30 days, including attachments. We send a confirmation when it completes.
The optional triage model is off until you turn it on. When enabled, only the case you’re asking about is sent — no other records, no identifiers we wouldn’t share with your vet.
Designed against the revised Federal Act on Data Protection. Records are personal data of the caregiver; processing is consent-led.
Lawful basis: contract performance plus your explicit consent for sharing. Subject-access, rectification and erasure are first-class flows in settings.
Loki is decision-support and record-keeping. It is not a regulated medical device. The triage flow refuses to diagnose and always routes urgent cases to a clinic.